Detect CVE-2026-109619 — PHP Stale Internal Request-State (PHP2Shell) Exploitation in IBM QRadar
Detects exploitation attempts against CVE-2026-109619, a PHP use-after-free / stale internal request-state vulnerability (dubbed 'PHP2Shell') affecting PHP Group's PHP interpreter. The flaw stems from reuse of freed/uninitialized request-state objects (CWE-416, CWE-824, CWE-755, CWE-1325) that attackers coerce into arbitrary code execution by crafting requests that trigger improper reinitialization of per-request globals, frequently in FPM/mod_php worker reuse scenarios. CISA added this to the KEV catalog on 2026-10-26 following mass in-the-wild exploitation that drops webshells on PHP-fronted web applications. This detection surfaces anomalous php-fpm/php-cgi worker crashes and restarts, child-process spawning from PHP (php spawning sh/bash/cmd), webshell-style POST request patterns, and segfault telemetry correlated with web-request bursts.
MITRE ATT&CK
- Tactic
- Initial Access Execution
QRadar Detection Query
-- df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence
SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "Process Name" AS process, "Parent Process Name" AS parent, payload
FROM events
WHERE ("Parent Process Name" ILIKE '%php%' OR "Parent Process Name" ILIKE '%httpd%' OR "Parent Process Name" ILIKE '%apache%' OR "Parent Process Name" ILIKE '%nginx%')
AND ("Process Name" ILIKE '%/sh' OR "Process Name" ILIKE '%/bash' OR "Process Name" ILIKE '%curl%' OR "Process Name" ILIKE '%wget%' OR "Process Name" ILIKE '%python%')
LAST 24 HOURSAQL query joining PHP/web-server parentage with shell or download child processes to surface CVE-2026-109619 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- PHP media-processing calls to external binaries
- Legitimate administrative scripts run under the web service account
- Security agents that spawn helper processes from the web tier
Other platforms for CVE-2026-109619
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 PHP worker spawns Unix shell
Expected signal: ProcessRollup2/DeviceProcessEvents record with parent php and child sh/id
- Test 2 PHP downloads and executes remote payload
Expected signal: php parent process spawning curl with an outbound HTTP request
- Test 3 php-fpm worker simulated crash under crafted request
Expected signal: syslog entry 'php-fpm child exited on signal 11' / segfault
References (8)
- https://www.php.net/
- https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-109619
- https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/
- https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
- https://isc.sans.edu/diary/rss/33440
Response Playbook
Triage
- Confirm the PHP runtime version on the affected host and compare against the patched release referenced in the CISA KEV advisory; flag any unpatched php-fpm/php-cgi/mod_php instances.
- Review the parent/child process tree: validate whether the PHP worker legitimately shells out, or whether the child shell/download command is anomalous for this application.
- Correlate the process spawn timestamp with web-server access logs to identify the inbound request (URI, method, User-Agent, source IP) that triggered the worker, looking for POST requests to unexpected endpoints.
- Check for php-fpm/php-cgi segfault or 'exited on signal 11' entries in error logs clustered around the event, indicating stale request-state corruption attempts.
Containment
- Isolate the affected web host from the network or place it behind a WAF rule blocking the identified exploit request pattern while preserving volatile state for forensics.
- Restart php-fpm pools and rotate worker processes to clear any attacker-controlled stale request-state, then disable process reuse (pm.max_requests=1) as a temporary mitigation until patched.
- Block the identified attacker source IPs at the edge and revoke any credentials or sessions exposed through dropped webshells.
Evidence Collection
- Capture the web-server access and error logs, php-fpm slow/error logs, and the full process-tree telemetry covering the spawn event.
- Preserve any files written to web-accessible directories (candidate webshells) and compute hashes; capture a memory image of the php-fpm process if still running.
Escalation Criteria
- !Escalate to IR lead if a webshell or persistence mechanism is confirmed, or if the PHP worker executed reverse-shell/download-and-execute commands.
- !Escalate to the asset owner and CISO track if the host is internet-facing and unpatched, given active KEV exploitation and the BOD 26-04 remediation timeline.
Investigation Guide
Forensic Artifacts
- >
php-fpm/php-cgi error logs showing segfaults or 'exited on signal 11' - >
Web-server access logs with the triggering POST request and anomalous User-Agent - >
Newly created or modified files in web-root/upload directories (candidate webshells) - >
Process-tree telemetry showing php -> sh/curl/wget lineage
Tuning Guidance
Enumerate PHP applications that legitimately call exec()/proc_open() (image/PDF processing, deployment hooks) and exclude their specific child commands and paths. Prioritize alerting on internet-facing, unpatched hosts and on download utilities (curl/wget) or reverse-shell patterns over benign local shells. Pair process-spawn alerts with php-fpm segfault telemetry to reduce noise.
Hunting Queries
Baselines PHP worker child-shell activity per host over time to surface spikes aligned with PHP2Shell exploitation waves.
// df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence
DeviceProcessEvents | where InitiatingProcessFileName in~ ("php","php-fpm","php-cgi") | where FileName in~ ("sh","bash","curl","wget","python3") | summarize count() by DeviceName, bin(Timestamp, 1h)``` df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence ```
index=linux (process_name="php-fpm" OR process_name="php-cgi") (child_process IN ("sh","bash","curl","wget")) | timechart span=1h count by hostAtomic Red Team Tests
Simulates PHP2Shell post-exploitation by having a PHP script shell out to bash, generating the php->sh parent/child telemetry this detection targets.
Command
php -r 'system("id; uname -a");'Cleanup
echo 'no cleanup required'Expected Telemetry
ProcessRollup2/DeviceProcessEvents record with parent php and child sh/id
Expected Detection
KQL/EQL/CQL rules fire on PHP parent spawning a shell
Emulates download-and-execute behavior following stale request-state corruption.
Command
php -r 'system("curl -s http://127.0.0.1:8000/x.sh -o /tmp/x.sh");'Cleanup
rm -f /tmp/x.shExpected Telemetry
php parent process spawning curl with an outbound HTTP request
Expected Detection
Rules match php->curl/wget child process
Simulates a php-fpm worker segfault to generate the signal-11 error-log telemetry correlated by this detection.
Command
php -r 'function b(){b();} b();' ; echo 'simulated php-fpm child exited on signal 11' | logger -t php-fpmCleanup
echo 'no cleanup required'Expected Telemetry
syslog entry 'php-fpm child exited on signal 11' / segfault
Expected Detection
SPL/Sumo segfault correlation triggers